module IapJwtAssertion

# File lib/iap_jwt_assertion.rb, line 11
def authenticate? token, aud:
  kid = get_kid(token)
  pubkey = get_key(kid)

  begin
    payload, header = JWT.decode(token, pubkey, true, {algorithm: ALGORITHM})

    if payload['aud'] != aud
      return false
    end
  rescue => e
    return false
  end

  return true
end

# File lib/iap_jwt_assertion.rb, line 28
def decode token
  kid = get_kid(token)
  pubkey = get_key(kid)

  return JWT.decode(token, pubkey, false, {algorithm: ALGORITHM})
end

# File lib/iap_jwt_assertion.rb, line 52
def fetch_public_keys
  response = Net::HTTP.get(URI(PUBLIC_KEYS_URL))
  response_hash = JSON.parse(response)
  public_keys = response_hash.map {|kid, pubkey| [kid, OpenSSL::PKey::EC.new(pubkey)]}.to_h

  return public_keys
end

# File lib/iap_jwt_assertion.rb, line 40
def get_key kid
  if @public_keys.nil? || !@public_keys.has_key?(kid)
    @public_keys = fetch_public_keys

    if !@public_keys.has_key?(kid)
      raise "kid was not found in the list of public keys."
    end
  end

  return @public_keys[kid]
end

# File lib/iap_jwt_assertion.rb, line 35
def get_kid token
  payload, header = JWT.decode(token, nil, false)
  return header['kid']
end